You have a Microsoft 365 E5 subscription that includes Microsoft Intune.
For macOS devices, you create an update policy named Policy1 that has the following settings:
• All other updates (OS, built-in apps): Download and install
• Assignments:
• Included groups: All Devices
Which two types of updates can be downloaded and installed by using Policy1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. configuration file
B. macOS
C. firmware
D. critical
E. built-in app
Show Answer
Correct Answer: B, E
Explanation: The policy setting selected is **All other updates (OS, built-in apps): Download and install**. In Intune macOS update policies, update types are divided into categories: Critical, Firmware, Configuration files, and All other updates (which explicitly includes the macOS operating system and built-in apps). Therefore, Policy1 can download and install macOS updates and built-in app updates, but not critical, firmware, or configuration file updates.
Question 135
Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com.
The domain contains a domain controller named dc1.contoso.com.
You have a Microsoft 365 E5 subscription that uses Microsoft Intune Suite.
You have an Azure subscription that contains the resources shown in the following table.
The subscription contains the virtual networks shown in the following table.
You plan to deploy Windows 365 Enterprise Cloud PC.
You need to create an Azure network connection (ANC) that will use Microsoft Entra hybrid join.
Which virtual network can you use for the ANC?
A. VNet1 only
B. VNet2 only
C. VNet3 only
D. VNet1 and VNet2
E. VNet1 and VNet3
Show Answer
Correct Answer: A
Explanation: For a Windows 365 Enterprise Azure network connection using Microsoft Entra hybrid join, the selected virtual network must be able to resolve AD DS DNS records and have network connectivity to a domain controller. VNet1 is configured to use the on‑premises AD DS DNS (dc1.contoso.com) and has connectivity to the domain controller, meeting all ANC hybrid join requirements. The other VNets lack the required DNS configuration and/or domain controller connectivity.
Question 136
HOTSPOT
-
You have a Microsoft 365 E5 subscription that uses Microsoft Intune.
You need to ensure that users can only enroll devices that meet the following requirements:
• Android devices that support the use of work profiles.
• iOS devices that run iOS 11.0 or later.
Which two restrictions should you modify? To answer, select the restrictions in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Android device administrator: Block
iOS/iPadOS: Set minimum OS version to 11.0
Explanation: Blocking Android device administrator ensures only Android Enterprise work profile–capable devices can enroll. Setting the iOS/iPadOS minimum version to 11.0 enforces the required OS level for iOS device enrollment.
Question 137
You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Microsoft Entra joined and are enrolled in Microsoft Intune.
You plan to manage Microsoft Defender for Endpoint on the computers.
You need to prevent users from disabling Microsoft Defender for Endpoint.
What should you do?
A. From the Microsoft Intune admin center, create a security baseline.
B. From the Microsoft Intune admin center, create an antivirus policy.
C. From the Microsoft Entra admin center, create a Conditional Access policy.
D. From the Microsoft Intune admin center, create a device compliance policy.
Show Answer
Correct Answer: B
Explanation: To prevent users from disabling Microsoft Defender for Endpoint, you must enforce Tamper Protection and Defender settings through Microsoft Intune. This is done by creating an Antivirus policy in Intune (Endpoint security > Antivirus), which allows you to enable Tamper Protection and lock down Microsoft Defender Antivirus settings. Security baselines are broader and not required, Conditional Access is unrelated, and compliance policies only report compliance rather than enforce Defender configuration.
Question 138
You have a Microsoft 365 subscription.
Each user is assigned a Windows 365 Enterprise license.
You need to deploy Cloud PCs that will be Microsoft Entra hybrid joined.
What should you do first?
A. Create an Azure network connection (ANC).
B. Create a provisioning policy.
C. Create a configuration profile in Microsoft Intune.
D. Upload a custom image.
Show Answer
Correct Answer: A
Explanation: To deploy Windows 365 Enterprise Cloud PCs that are Microsoft Entra hybrid joined, you must first create an Azure network connection (ANC). Hybrid-joined Cloud PCs require line-of-sight connectivity to on-premises domain controllers for domain join and ongoing authentication. The ANC defines the Azure virtual network, subnet, and domain details that enable this connectivity. Provisioning policies, configuration profiles, and custom images all depend on an existing ANC and cannot be completed first.
Question 139
You have a Microsoft 365 subscription that has Windows 365 Enterprise licenses.
You plan to use a custom Windows 11 image as a template for Cloud PCs.
You have a Hyper-V virtual machine that runs Windows 11 and has the following configurations:
• Name: VM1
• Disk size: 64 GB
• Disk format: VHDX
• Disk type: Fixed size
• Generation: Generation 2
You need to ensure that you can use VM1 as a source for the custom image.
What should you do on VM1 first?
A. Change the disk type to Dynamically expanding.
B. Change the disk format to the VHD.
C. Change the generation to Generation 1.
D. Increase the disk size.
Show Answer
Correct Answer: B
Explanation: Windows 365 Enterprise custom images must be uploaded as VHD files. VHDX disks aren’t supported for Windows 365 image import, even for Generation 2 VMs running Windows 11. Therefore, the first required change is to convert the disk format from VHDX to VHD. The disk size, fixed type, and Generation 2 configuration are already acceptable.
Question 140
HOTSPOT
-
Your on-premises network contains an Active Directory domain named contoso.com. The domain contains a user account named Admin1 and the resources shown in the following table.
You have a Microsoft 365 E5 subscription.
You have a Microsoft Entra tenant that syncs with contoso.com.
Admin1 plans to use Windows Autopilot to deploy 100 Windows 11 devices. The deployment must meet the following requirements:
• The devices must be Microsoft Entra hybrid joined during the deployment.
• Computer objects must be created in OU1.
You need to configure Server1 and Active Directory delegation to support the deployment.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Server1:
Install the Intune Connector for Active Directory.
Resource:
OU1
Explanation: Windows Autopilot hybrid Microsoft Entra join requires the Intune Connector to be installed on an on-premises server to create computer accounts in Active Directory. Delegating permissions on OU1 ensures computer objects are created in the required organizational unit during deployment.
Question 141
You have a Microsoft 365 E5 subscription.
You use Microsoft Intune to manage all devices.
You need to prepare a Win32 app named App1.exe for deployment.
What should you do first?
A. From the Microsoft Intune admin center, create an app configuration policy.
B. Change App1.exe to the INTUNEWIN format.
C. From the Microsoft 365 Apps admin center, create a deployment configuration.
D. Upload App1.exe to Azure Blob Storage.
Show Answer
Correct Answer: B
Explanation: To deploy a Win32 application with Microsoft Intune, the executable must first be packaged into the .intunewin format using the Microsoft Win32 Content Prep Tool. This preprocessing step is required before the app can be uploaded and configured in the Intune admin center. Other options occur later in the process or are not applicable to Win32 app preparation.
Question 142
You have a Microsoft 365 subscription that includes Microsoft Intune.
You need to deploy a custom app to Android devices. The app uses the APK file format.
Which type of app should you select for the deployment?
A. built-in
B. Android store
C. Managed Google Play
D. line-of-business (LOB)
E. web link
Show Answer
Correct Answer: D
Explanation: For deploying a custom Android application packaged as an APK file directly through Microsoft Intune, the correct app type is Line-of-business (LOB). LOB apps are used for in-house or custom apps that aren’t published to the public Google Play Store. Managed Google Play is primarily for public or private apps distributed via Google Play, whereas a raw APK upload aligns with the LOB app model.
Question 143
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Intune to manage Windows 11 devices.
You need to implement Windows Local Administrator Password Solution (Windows LAPS).
What should you configure?
A. a configuration profile
B. an account protection policy
C. an app protection policy
D. a device compliance policy
Show Answer
Correct Answer: B
Explanation: Windows LAPS in Microsoft Intune is configured through Endpoint security > Account protection policies. These policies are specifically designed to manage local administrator accounts, enforce password complexity, enable automatic password rotation, and back up the passwords to Microsoft Entra ID or AD. Configuration profiles, app protection policies, and device compliance policies do not provide the dedicated LAPS management capabilities required.
$19
Get all 373 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
